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Direct Marketing Code — Call for views 20181112 v1.0 
ICO call for views on a direct marketing code of practice VOT E+ 


The Information Commissioner is calling for views on a direct marketing code of practice. 


The Data Protection Act 2018 requires the Commissioner to produce a code of practice that provides 
practical guidance and promotes good practice in regard to direct marketing. 


While direct marketing is an important and useful tool to help organisations engage with people in 
order to grow their business or to publicise and gain support for their causes, it can also be intrusive 
and have a negative impact on people if done badly. This can cause reputational damage to 
organisations and, in some cases, result in fines or other regulatory action for breaking data 
protection laws. 


So it is important that organisations ensure their marketing activities are compliant with data 
protection legislation (the General Data Protection Regulation and Data Protection Act 2018) and, 
where necessary, the Privacy and Electronic Communications Regulations 2003 (PECR). 

We have previously published detailed direct marketing guidance. The new code will build on that 
guidance and address the aspects of the new legislation relevant to direct marketing such as 
transparency and lawful bases for processing, as well as covering the rules on electronic marketing 
(for example emails, text messages, phone calls) under PECR. 


The European Union is in the process of replacing the current e-privacy law (and therefore PECR) 
with a new ePrivacy Regulation (ePR). However the new ePR is yet to be agreed and there is no 
certainty about what the final rules will be. Because of this we intend for the direct marketing code 
to only cover the current PECR rules until the ePR is agreed. Once the ePR is finalised and the UK 
position in relation to it is clear we will produce an updated version of the code which takes this into 
account as appropriate. 


This call for views is the first stage of the consultation process. The Commissioner is seeking input 
from relevant stakeholders, including trade associations, data subjects and those representing the 
interests of data subjects. We will use the responses we receive to inform our work in developing 
the code. 


You can email your response to directmarketingcode@ico.org.uk 


Or print and post to: 

Direct Marketing Code Call for Views 
Engagement Department 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire SK9 5AF 


If you would like further information on the call for views, please email the Direct ‘Marketing Code 
team. 


Please send us your views by 24 December 2018. 


Privacy statement 

For this call for views we will publish responses received from organisations but will remove any 
personal data before publication. We will not publish responses from individuals. For more 
information about what we do with personal data please see our privacy notice. 


Questions 


Q1 The code will address the changes in data protection legislation and the implications for direct 
marketing. What changes to the data protection legislation do you think we should focus on in the 
direct marketing code? 


Q2 Apart from the recent changes to data protection legislation are there other developments 
that are having an impact on your organisation’s direct marketing practices that you think we 
should address in the code? 

Yes 

No 


Q3 If yes please specify 

As digital developments continue at pace in the twenty-first century the traditional marketing 
methods of telephone, post, email and text message will face increased competition from things like 
mobile apps and web platforms. The code and guidance needs to take these into account. As it is, 
there is a danger organisations adopt technologies before there is explicit guidance to govern their 
usage. Subsequent guidance can damage work already done with the best intentions. 


Q4 We are planning to produce the code before the draft ePrivacy Regulation (ePR) is agreed. We 
will then produce a revised code once the ePR becomes law. Do you agree with this approach? 
Yes 

No 


Q5 If no please explain why you disagree 

Such an approach may cause organisations to change their approach twice; before and after ePR. 
This is disruptive and counterproductive for all involved: both data controllers and data subjects. As 
we saw with GDPR the guidance available can evolve before a regulation becomes law. It would be 
best to focus these efforts on developing a new code — which are warmly welcomed — on ePR. 


Q6 Is the content of the ICO’s existing direct marketing guidance relevant to the marketing that 
your organisation is involved in? 

Yes 

No 


Q7 If no what additional areas would you like to see covered? 


Please see answers to Q3 and Q11, as these comments are also relevant here. `œ: wae 


Q8 Is it easy to find information in our existing direct marketing guidance? 
Yes 
No 


Q9 If no, do you have any suggestions on how we should structure the direct marketing code? 
See Q11 —- need to structure a code based on more realistic understanding of what data subjects 
understand ‘marketing’ to mean in the context of universities. 


Q10 Please provide details of any case studies or marketing scenarios that you would like to see 
included in the direct marketing code. 
N/A. 


Q11 Do you have any other suggestions for the direct marketing code? 
The major challenge is the definition of ‘marketing’. What is defined as ‘marketing’ under the 
guidance is not seen as ‘marketing’ at all by the data subjects with whom we engage as a university 
from the perspective of fundraising and alumni relations. Alumni of universities have a relationship 
with the institution that begins when they choose to apply and which is cultivated over the course of 
their studies and continues following their graduation. The Data Protection Act 2018’s description of 
‘direct marketing’ as ‘the communication (by whatever means) of advertising or marketing material 
which is directed to particular individuals’ does not align with the aim of universities to maintain a 
relationship with their graduates so they can continue to develop mutually beneficial partnerships. 
The current guidance states that ‘marketing’ also encompasses promotion of ‘aims and ideals’ but a 
balanced view needs to be taken which accounts for the fact that universities exist for the public 
good and not as profit making enterprises. Universities’ engagement for fundraising and alumni 
relations is with individuals with whom they have a prior, usually very positive connection. 
Universities change lives and the world with their teaching, research and commitment to the 
communities they serve. Through their support alumni are a fundamental part of this. 
Communications, engagement and fundraising programmes involving alumni and supporters are 
vastly different to corporate sales and marketing; furthermore our data shows that such interaction 
is expected by our graduates, and in many cases, warmly welcomed. This said, we do feel strongly 
that such engagement needs robust guidelines, including the provision of clear privacy notices and 
ways for individuals to have control of their data and opt out from some or all processing simply and 
easily. The steps the ICO has taken in this respect in the recent past have been positive, helpful and 
welcome. A further positive development, however, would be to consider and then provide more 
realistic clarity on what constitutes ‘marketing’ following engagement with universities to 
understand their experience of communicating with alumni and supporters. At present, too much of 
the guidance is based on assumptions which in our experience differ from what our data subjects 
expect. We are a values driven organization committed to best practice and the law, but the current 
approach of the regulatory bodies has the potential to damage the positive impact we make through 
our teaching, research and social responsibility agendas by restricting, however inadvertently, the 
ways in which alumni and supporters can interact with and contribute to our mission. 


About you (for Information Governance to complete) 


Q22:Are you answering these questions as? 
A public sector worker Awa 


se 


A private sector worker 

A third or voluntary sector worker 

A member of the public 

A representative of a trade association 

A data subject 

An ICO employee 

Other 

If you answered ‘other’ please specify: Higher Education provider 


Q13 Please provide the name of the organisation that you are representing. 
University of Manchester 


Q14 We may want to contact you about some of the points you have raised. If you are happy for 
us to do this please provide your email address: 


Thank you for taking the time to share your views and experience. 


